starlingx/docs
Code Issues Proposed changes
docs/doc/source/security/kubernetes/create-certificates-locally-using-cert-manager-on-the-controller.rst
Keane Lim 3c5fa979a4 Security guide update 
Re-organized topic hierarchy

Tiny edit to restart review workflow.

Squashed with Resolved index.rst conflict commit

Change-Id: I13472792cb19d1e9975ac76c6954d38054d606c5
Signed-off-by: Keane Lim <keane.lim@windriver.com>
Signed-off-by: MCamp859 <maryx.camp@intel.com>
2021-03-12 15:10:40 -05:00

3.2 KiB
Raw Blame History

Create Certificates Locally using cert-manager on the Controller

You can use cert-manager to locally create certificates suitable for use in a lab environment.

  1. Create a Root Certificate and Key.

    1. Create a self-signing issuer.

      $ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: my-selfsigning-issuer
spec:
  selfSigned: {}
" | kubectl apply -f -

    2. Create a Root CA certificate and key.

      $ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: my-rootca-certificate
spec:
  secretName: my-rootca-certificate
  commonName: "my-rootca"
  isCA: true
  issuerRef:
    name: my-selfsigning-issuer
    kind: Issuer
" | kubectl apply -f -

    3. Create a Root CA Issuer.

      $ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: my-rootca-issuer
spec:
  ca:
    secretName: my-rootca-certificate
" | kubectl apply -f -

    4. Create files for the Root CA certificate and key.

      $ kubectl get secret my-rootca-certificate -o yaml | egrep "^  tls.crt:" | awk '{print $2}' | base64 --decode > my-rootca-cert.pem
$ kubectl get secret my-rootca-certificate -o yaml | egrep "^  tls.key:" | awk '{print $2}' | base64 --decode > my-rootca-key.pem
  2. Create and sign a Server Certificate and Key.

    1. Create the Server certificate and key.

      $ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: my-server-certificate
spec:
  secretName: my-server-certificate
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  organization:
  - WindRiver
  commonName: 1.1.1.1
  dnsNames:
  - myserver.wrs.com
  ipAddresses:
  - 1.1.1.1
  issuerRef:
    name: my-rootca-issuer
    kind: Issuer
" | kubectl apply -f -

    2. Create the files for Server certificate and key.

      $ kubectl get secret my-server-certificate -o yaml | egrep "^  tls.crt:" | awk '{print $2}' | base64 --decode > my-server-cert.pem
$ kubectl get secret my-server-certificate -o yaml | egrep "^  tls.key:" | awk '{print $2}' | base64 --decode > my-server-key.pem

    3. Combine the server certificate and key into a single file.

      $ cat my-server-cert.pem my-server-key.pem > my-server.pem